CVE-2026-92370

Published Sep 29, 2026

Last updated a day ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-92370 is an improper access control vulnerability affecting TeamViewer Full Client, Host, and related modules on Windows, Linux, and macOS platforms prior to version 15.82. The flaw occurs during the session establishment phase, where the software fails to properly validate access rights against configured security policies. This allows an authenticated remote attacker to manipulate or bypass user-configured permission settings by modifying access control parameters for restricted features. By exploiting this vulnerability, an attacker can perform actions that were explicitly denied by the victim's configuration. This bypass can lead to unauthorized actions on the target system, potentially allowing the attacker to achieve remote code execution. TeamViewer has addressed this issue in version 15.82, as well as in supported maintenance and legacy releases, and recommends that users update their software to resolve the issue.

Description: An improper access control vulnerability in TeamViewer Full Client, Host, and related affected modules on Windows, Linux, and macOS allows an authenticated remote attacker to bypass user-configured permission settings during session establishment. By modifying access control parameters for restricted features, an attacker can perform actions that were explicitly denied by the victim's configuration. This may result in unauthorized actions and potentially lead to remote code execution on the target system.
Source: psirt@teamviewer.com
NVD status: Deferred

Risk scores

CVSS 3.1

Type: Secondary
Base score: 8.8
Impact score: 5.9
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

psirt@teamviewer.com: CWE-284

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 2

References